diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2016-01-18 19:20:03 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2016-01-31 00:24:51 +0100 |
| commit | 9f30eafd0f31c2b5c4f7c86fecabbdde1282e079 (patch) | |
| tree | 7c04422904f52deca9bb03fd1cf22ed8b806b3ab | |
| parent | 22e20a1d833e5ce8c560a6c0d6f4b4e78b075385 (diff) | |
| download | ffmpeg-9f30eafd0f31c2b5c4f7c86fecabbdde1282e079.tar.gz | |
avcodec/gif: Fix lzw buffer size
Fixes out of array access
Fixes: aaa479088e6fb40b04837b3119f47b04/asan_heap-oob_e38c68_8576_9d653078b2470700e2834636f12ff557.tga
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 03d83ba34b2070878909eae18dfac0f519503777)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavcodec/gif.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/libavcodec/gif.c b/libavcodec/gif.c index def1b83e9d..b56d58c4df 100644 --- a/libavcodec/gif.c +++ b/libavcodec/gif.c @@ -43,6 +43,7 @@ typedef struct { const AVClass *class; LZWState *lzw; uint8_t *buf; + int buf_size; AVFrame *last_frame; int flags; uint32_t palette[AVPALETTE_COUNT]; ///< local reference palette for !pal8 @@ -168,7 +169,7 @@ static int gif_image_write_image(AVCodecContext *avctx, bytestream_put_byte(bytestream, 0x08); - ff_lzw_encode_init(s->lzw, s->buf, 2 * width * height, + ff_lzw_encode_init(s->lzw, s->buf, s->buf_size, 12, FF_LZW_GIF, put_bits); ptr = buf + y_start*linesize + x_start; @@ -224,7 +225,8 @@ static av_cold int gif_encode_init(AVCodecContext *avctx) avctx->coded_frame->key_frame = 1; s->lzw = av_mallocz(ff_lzw_encode_state_size); - s->buf = av_malloc(avctx->width*avctx->height*2); + s->buf_size = avctx->width*avctx->height*2 + 1000; + s->buf = av_malloc(s->buf_size); s->tmpl = av_malloc(avctx->width); if (!s->tmpl || !s->buf || !s->lzw) return AVERROR(ENOMEM); @@ -283,6 +285,7 @@ static int gif_encode_close(AVCodecContext *avctx) av_freep(&s->lzw); av_freep(&s->buf); + s->buf_size = 0; av_frame_free(&s->last_frame); av_freep(&s->tmpl); return 0; |